- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
Severity across 44 analyzed records
As of 09/11/2026, Xen recorded 11 security vulnerabilities in the last 90 days across 4 products, including 11 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, XAPI had the most security vulnerabilities in the Xen ecosystem, with 6 vulnerabilities—approximately 54.55% of the provider's total vulnerabilities during this period.
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-79603Unconditionally do TLB flushing ahead of page scrubbing | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/08/2026 | SeverityMedium |
CVE-2026-79602x86: improper handling of HVM emulation return codes | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/08/2026 | SeverityHigh |
CVE-2026-62437x86: DMs may cause mem leak by IRQ binding | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/08/2026 | SeverityMedium |
CVE-2026-62434PoD: Don't try to reclaim special pages | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityMedium |
CVE-2026-62433correct buffer checks for DM_OP hypercalls | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityHigh |
CVE-2026-62432evtchn: Race between FIFO expand and reset | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityHigh |
CVE-2026-62431Viridian STIMER division by zero | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityHigh |
CVE-2026-62430x86: Out-of-bounds read in vRTC emulation | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityHigh |
CVE-2026-62429vNUMA domain cleanup may race other operations | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityMedium |
CVE-2026-62436grant-table: version change racing with other operations | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityMedium |
CVE-2026-62435grant-table: version change racing with other operations | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityMedium |
CVE-2026-62428grant-table: type confusion in grant-copy | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityHigh |
CVE-2026-62427sysctl and platform-op locks open to abuse | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityHigh |
CVE-2026-62426sysctl and platform-op locks open to abuse | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityHigh |
CVE-2026-62425buffer overruns in libfsimage iso9660 handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityMedium |
CVE-2026-62424buffer overruns in libfsimage iso9660 handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityMedium |
CVE-2026-62423buffer overruns in libfsimage iso9660 handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityMedium |
CVE-2026-42495buffer overruns in libfsimage iso9660 handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityMedium |
CVE-2026-42494buffer overruns in libfsimage iso9660 handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityMedium |
CVE-2026-42492vIRQ event channel binding may break Xenstore | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityHigh |
CVE-2026-42493x86 shadow paging is deprecated | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/28/2026 | SeverityHigh |
CVE-2026-42486Multiple RBAC issues in XAPI | Exploitation statusNot known exploited | FixNot confirmed | Affected productXAPI | Published07/09/2026 | SeverityCritical |
CVE-2026-23562Multiple RBAC issues in XAPI | Exploitation statusNot known exploited | FixNot confirmed | Affected productXAPI | Published07/09/2026 | SeverityCritical |
CVE-2026-23561Multiple RBAC issues in XAPI | Exploitation statusNot known exploited | FixNot confirmed | Affected productXAPI | Published07/09/2026 | SeverityCritical |
CVE-2026-23560Multiple RBAC issues in XAPI | Exploitation statusNot known exploited | FixNot confirmed | Affected productXAPI | Published07/09/2026 | SeverityCritical |
CVE-2026-23559Multiple RBAC issues in XAPI | Exploitation statusNot known exploited | FixNot confirmed | Affected productXAPI | Published07/09/2026 | SeverityCritical |
CVE-2026-23556oxenstored keeps quota related use counts across domain destruction | Exploitation statusNot known exploited | FixNot confirmed | Affected productoxenstored | Published07/09/2026 | SeverityCritical |
CVE-2025-58151varstored: TOCTOU issues with mapped guest memory | Exploitation statusNot known exploited | FixNot confirmed | Affected productvarstored | Published07/09/2026 | SeverityCritical |
CVE-2025-58146XAPI UTF-8 string handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productXAPI | Published07/09/2026 | SeverityCritical |
CVE-2025-27464WinPVDrivers: Excessive permissions on user-exposed devices | Exploitation statusNot known exploited | FixNot confirmed | Affected productWindows PV drivers | Published07/09/2026 | SeverityCritical |
CVE-2025-27463WinPVDrivers: Excessive permissions on user-exposed devices | Exploitation statusNot known exploited | FixNot confirmed | Affected productWindows PV drivers | Published07/09/2026 | SeverityCritical |
CVE-2025-27462WinPVDrivers: Excessive permissions on user-exposed devices | Exploitation statusNot known exploited | FixNot confirmed | Affected productWindows PV drivers | Published07/09/2026 | SeverityCritical |
CVE-2026-42488x86: mismatched mapcache metadata | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/18/2026 | SeverityHigh |
CVE-2026-42490domctl lock open to abuse | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/18/2026 | SeverityMedium |
CVE-2026-42489domctl lock open to abuse | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/18/2026 | SeverityMedium |
CVE-2026-42487x86 HVM I/O port list traversal | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published06/18/2026 | SeverityHigh |
CVE-2026-23558grant table v2 race in status page mapping | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published05/19/2026 | SeverityHigh |
CVE-2026-23557Xenstored DoS via XS_RESET_WATCHES command | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published05/19/2026 | SeverityMedium |
CVE-2026-23555Xenstored DoS by unprivileged domain | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/23/2026 | SeverityHigh |
CVE-2026-23554Use after free of paging structures in EPT | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/23/2026 | SeverityHigh |
CVE-2026-23553x86: incomplete IBPB for vCPU isolation | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/28/2026 | SeverityLow |
CVE-2025-58150x86: buffer overrun with shadow paging + tracing | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/28/2026 | SeverityHigh |
CVE-2025-58149Incorrect removal of permissions on PCI device unplug | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/31/2025 | SeverityHigh |
CVE-2025-58148x86: Incorrect input sanitisation in Viridian hypercalls | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/31/2025 | SeverityHigh |
CVE-2025-58147x86: Incorrect input sanitisation in Viridian hypercalls | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published10/31/2025 | SeverityHigh |
CVE-2025-58145Arm issues with page refcounting | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/11/2025 | SeverityHigh |
CVE-2025-58144Arm issues with page refcounting | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/11/2025 | SeverityHigh |
CVE-2025-58143Mutiple vulnerabilities in the Viridian interface | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/11/2025 | SeverityCritical |
CVE-2025-58142Mutiple vulnerabilities in the Viridian interface | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/11/2025 | SeverityCritical |
CVE-2025-27466Mutiple vulnerabilities in the Viridian interface | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/11/2025 | SeverityCritical |
CVE-2025-1713deadlock potential with VT-d and legacy PCI device pass-through | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/17/2025 | SeverityHigh |
CVE-2025-27465x86: Incorrect stubs exception handling for flags recovery | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/16/2025 | SeverityMedium |
CVE-2024-31144Xapi: Metadata injection attack against backup/restore functionality | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/14/2025 | SeverityLow |
CVE-2024-2201CVE-2024-2201 | Exploitation statusNot known exploited | FixNot confirmed | Affected productxen | Published12/19/2024 | SeverityMedium |
CVE-2024-45819libxl leaks data to PVH guests via ACPI tables | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/19/2024 | SeverityMedium |
CVE-2024-45818Deadlock in x86 HVM standard VGA handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/19/2024 | SeverityMedium |
CVE-2024-45817x86: Deadlock in vlapic_error() | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/25/2024 | SeverityHigh |
CVE-2024-31146PCI device pass-through with shared resources | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/25/2024 | SeverityHigh |
CVE-2024-31145error handling in x86 IOMMU identity mapping | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/25/2024 | SeverityHigh |
CVE-2024-31143double unlock in x86 guest IRQ handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/18/2024 | SeverityHigh |
CVE-2024-31142x86: Incorrect logic for BTC/SRSO mitigations | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published05/16/2024 | SeverityHigh |
CVE-2023-46842x86 HVM hypercalls may trigger Xen bug check | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published05/16/2024 | SeverityMedium |
CVE-2023-46841x86: shadow stack vs exceptions from emulation stubs | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/20/2024 | SeverityMedium |
CVE-2023-46840VT-d: Failure to quarantine devices in !HVM builds | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/20/2024 | SeverityMedium |
CVE-2023-46839pci: phantom functions assigned to incorrect contexts | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published03/20/2024 | SeverityMedium |
CVE-2024-2193Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace. | Exploitation statusNot known exploited | FixNot confirmed | Affected productxen | Published03/15/2024 | SeverityMedium |
CVE-2023-46837arm32: The cache may not be properly cleaned/invalidated (take two) | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityLow |
CVE-2023-46836x86: BTC/SRSO fixes not fully effective | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityMedium |
CVE-2023-46835x86/AMD: mismatch in IOMMU quarantine page table levels | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityMedium |
CVE-2023-34328x86/AMD: Debug Mask handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityMedium |
CVE-2023-34327x86/AMD: Debug Mask handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityMedium |
CVE-2023-34325Multiple vulnerabilities in libfsimage disk handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityHigh |
CVE-2023-34326x86/AMD: missing IOMMU TLB flushing | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityHigh |
CVE-2023-34324Possible deadlock in Linux kernel event handling | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityMedium |
CVE-2023-34323xenstored: A transaction conflict can crash C Xenstored | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityMedium |
CVE-2023-34322top-level shadow reference dropped too early for 64-bit PV guests | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityHigh |
CVE-2023-34321arm32: The cache may not be properly cleaned/invalidated | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published01/05/2024 | SeverityLow |
CVE-2023-34320arm: Guests can trigger a deadlock on Cortex-A77 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/08/2023 | SeverityUnknown |
CVE-2023-4949Memory Corruption Vulnerability in Grub-Legacy's XFS Implementation | Exploitation statusNot known exploited | FixYes | Affected productGrub-Legacy | Published11/10/2023 | SeverityHigh |
CVE-2023-34319Linux: buffer overrun in netback due to unusual packet | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published09/22/2023 | SeverityHigh |
CVE-2022-40982CVE-2022-40982 | Exploitation statusNot known exploited | FixNot confirmed | Affected productIntel(R) Processors | Published08/11/2023 | SeverityMedium |
CVE-2023-20588Speculative Leaks | Exploitation statusNot known exploited | FixNot confirmed | Affected productEPYC™ 7001 Processors | Published08/08/2023 | SeverityUnknown |
CVE-2023-20593CVE-2023-20593 | Exploitation statusPublic exploit | FixNot confirmed | Affected productRyzen™ 3000 Series Desktop Processors “Matisse” AM4 | Published07/24/2023 | SeverityUnknown |
CVE-2022-4949AdSanity < 1.8.2 - Authenticated Arbitrary File Upload | Exploitation statusNot confirmed | FixYes | Affected productAdSanity | Published06/07/2023 | SeverityHigh |
CVE-2022-42336CVE-2022-42336 | Exploitation statusNot known exploited | FixNot confirmed | Affected productxen | Published05/17/2023 | SeverityLow |
CVE-2022-42335CVE-2022-42335 | Exploitation statusNot confirmed | FixNot confirmed | Affected productxen | Published04/25/2023 | SeverityUnknown |
CVE-2022-42333CVE-2022-42333 | Exploitation statusNot confirmed | FixNot confirmed | Affected productxen | Published03/21/2023 | SeverityUnknown |
CVE-2022-42332CVE-2022-42332 | Exploitation statusNot known exploited | FixNot confirmed | Affected productxen | Published03/21/2023 | SeverityUnknown |
CVE-2022-42331CVE-2022-42331 | Exploitation statusNot confirmed | FixNot confirmed | Affected productxen | Published03/21/2023 | SeverityUnknown |
CVE-2022-42334CVE-2022-42334 | Exploitation statusNot confirmed | FixNot confirmed | Affected productxen | Published03/21/2023 | SeverityUnknown |
CVE-2022-42330CVE-2022-42330 | Exploitation statusNot confirmed | FixNot confirmed | Affected productxen | Published01/26/2023 | SeverityUnknown |
CVE-2022-23824CVE-2022-23824 | Exploitation statusNot confirmed | FixNot confirmed | Affected productAMD Processors | Published11/09/2022 | SeverityUnknown |
CVE-2022-42314CVE-2022-42314 | Exploitation statusNot known exploited | FixNot confirmed | Affected productxen | Published11/01/2022 | SeverityMedium |
CVE-2022-42315CVE-2022-42315 | Exploitation statusNot known exploited | FixNot confirmed | Affected productxen | Published11/01/2022 | SeverityMedium |
CVE-2022-42323CVE-2022-42323 | Exploitation statusNot confirmed | FixNot confirmed | Affected productxen | Published11/01/2022 | SeverityUnknown |
CVE-2022-42313CVE-2022-42313 | Exploitation statusNot known exploited | FixNot confirmed | Affected productxen | Published11/01/2022 | SeverityMedium |
CVE-2022-42317CVE-2022-42317 | Exploitation statusNot known exploited | FixNot confirmed | Affected productxen | Published11/01/2022 | SeverityMedium |
CVE-2022-42324CVE-2022-42324 | Exploitation statusNot confirmed | FixNot confirmed | Affected productxen | Published11/01/2022 | SeverityUnknown |
CVE-2022-42322CVE-2022-42322 | Exploitation statusNot confirmed | FixNot confirmed | Affected productxen | Published11/01/2022 | SeverityUnknown |
CVE-2022-42319CVE-2022-42319 | Exploitation statusNot confirmed | FixNot confirmed | Affected productxen | Published11/01/2022 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
%20Processors.svg){kind=icon}
